Proactive Tasks
PassAudited by ClawScan on May 10, 2026.
Overview
The skill is a coherent local task tracker, but it deliberately uses persistent workspace memory and optional heartbeat/cron autonomy, so users should opt in and scope it carefully.
This looks acceptable if you want a local task manager that can support proactive agent work. Before enabling heartbeat or cron, review HEARTBEAT.md yourself, limit what the agent may do autonomously, avoid storing sensitive information in task notes, and verify the documented commands match the included script.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If enabled, the agent may spend time on tasks and send updates on a schedule, which could be surprising if the task list or heartbeat instructions are stale.
The documentation shows an optional recurring heartbeat setup that can cause the agent to work periodically without a new user prompt. The artifacts do not auto-install this cron job, but enabling it creates ongoing autonomous behavior.
Create cron job (fires every 30 minutes): ```bash */30 * * * * /path/to/send-heartbeat.sh ```
Only enable heartbeat or cron after defining allowed goals, time limits, and notification rules, and keep an easy way to disable the scheduled job.
A changed or overly broad HEARTBEAT.md could redirect the agent’s autonomous work.
The skill makes a persistent workspace file authoritative for heartbeat behavior. That is purpose-aligned, but if the file is edited unexpectedly, the agent may follow unintended instructions.
Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats.
Keep HEARTBEAT.md user-controlled, narrowly scoped, and reviewed before enabling scheduled heartbeats.
Task names, notes, blockers, and progress may persist across sessions and shape future agent behavior.
The skill intentionally stores task context in persistent files and tells the agent to rely on them after context loss. This is disclosed and local, but stale or incorrect task state can influence later sessions.
SESSION-STATE.md is your "RAM" - the ONLY place task details are reliably preserved. ... After compaction: Read `working-buffer.md`
Do not put secrets in tasks or notes, periodically review the memory/session files, and clear or correct stale entries.
Setup commands may fail or users may be tempted to add/run a helper script that was not part of the reviewed package.
Some examples reference task_manager_phase2.py, while the provided manifest lists only scripts/task_manager.py. This looks like documentation drift rather than malicious behavior, but copied automation could point to a missing or unreviewed helper.
python3 scripts/task_manager_phase2.py mark-progress <task_id> <percent>
Use the included scripts/task_manager.py commands unless the publisher supplies and documents any additional helper files.